No hiding place

The protection of privacy will be a huge problem for the internet society

THE next time you are on the internet, try an experiment. Change the default setting for “cookies” in your web browser from “accept” to “prompt”, or “warn”, or whatever equivalent is offered, then browse the web for a few minutes. You will soon be bombarded with messages telling you that almost every website you visit is trying to plant cookies—small text files that collect information about your browsing habits—on your computer. The Economist website is no exception. Your every move on the internet is being recorded by someone, somewhere.

Cookies caused a furore when their widespread use was first publicised years ago, but now they are accepted as standard practice; indeed, their use has expanded vastly, and using the web without them is now virtually impossible. Information they provide is shared by thousands of websites through advertising-network companies. The largest of these, DoubleClick, has agreements with over 11,000 websites and maintains cookies on 100m users. These can be linked to hundreds of pieces of information about each user's browsing behaviour. In addition, users are being tracked through other methods by internet service providers, website hosts and e-mail services.

Cookies caused a furore when their widespread use was first publicised years ago; now they are accepted as standard practice

Offline, too, monitoring of people's behaviour has increased by leaps and bounds in recent years. The use of credit, store and debit cards leaves a trail of electronic data. So does turning on a mobile phone, even if no calls are made or received. The phone operator can not only monitor calls but also record the location of the phone. Electronic systems for public-transport tickets, road tolls and access to buildings of all kinds are expected to spread rapidly. Governments around the world are moving to record their own transactions and the provision of services to their citizens electronically. Monitoring of telephone calls, voicemail, e-mail and computer use by employers is easier and more widespread than ever before.

The use of video surveillance cameras is also growing. Britain has an estimated 1.5m cameras monitoring public places. According to one estimate, the average Briton is recorded by CCTV cameras 300 times a day. As cameras have become cheaper, smaller and more effective, they are proliferating and can now be found almost anywhere: airports, aeroplanes, buses, shopping malls, schools, public buildings, offices, factories and increasingly in people's homes too. Digital cameras allow the images collected to be stored and analysed much faster and more cheaply than in the past.

And this is only the beginning. Engineers are now developing cameras that employ low-level radiation to “see” through clothing, walls or cars. Miniature bugging devices capable of transmitting video or audio signals for miles and for years, commercial satellites powerful enough to recognise objects as small as one metre across, and tiny tracking chips cheap enough to be attached to many products or people are already available. Cheaper and more powerful versions are expected in the next few years. Technologies such as face-recognition software and biometric identification, which security experts say are not yet reliable enough, are being installed nevertheless, and will improve over the coming decade, as will the ability to crunch and analyse the mountain of data generated by all this monitoring.

Get off my back

In other words, a society capable of constant and pervasive surveillance is being rapidly built around us, sometimes with our co-operation, more often without our knowledge. Opinion polls consistently show that the public would prefer more privacy, and is concerned about its erosion. Occasionally there is a burst of publicity about some particularly intrusive new method of data collection. But once the fuss is over, the public acquiesces in the surrender of more information—until the next revelation.

This is what has happened since the terrorist attacks of September 11th 2001. Governments everywhere, not just in the United States, have rushed to expand their powers of surveillance. Even the European Union, which has long been at loggerheads with America about data protection, performed a sharp U-turn, relaxing legal restraints on the collection and use of information by governments. Last June the EU adopted a new directive to allow member states to require firms to retain data on everyone using mobile phones, landlines, e-mails, chatrooms, the internet or any other electronic device. In America, the USA Patriot Act, passed in the wake of September 11th, made it much easier for the authorities to obtain court permission to monitor internet traffic and obtain wiretaps. The technology to do this is being built into the internet's infrastructure. Campaigners for privacy protection sometimes give the impression that the battle is already lost.

That may be the wrong conclusion. Instead, privacy is likely to become one of the most contentious and troublesome issues in western politics. There will be constant arguments about what trade-offs to make between privacy on the one hand and security, economic efficiency and convenience on the other. Most people are repelled by the idea of near-constant surveillance, but they either find it difficult to believe that it will really happen, or they do not know how to stop it.

Salami technique

One problem is that privacy is hard to define or protect in the abstract. Presented with the prospect of losing it, many people might well prefer to eschew the substantial benefits that new technology offers. But they will not, in practice, be offered that choice. Instead, each benefit—more security against terrorists or criminals, better government services, higher productivity at work, better medical care, a wider selection of products, more convenience, more entertainment—will seem worth the surrender of a bit more personal information, or a marginal increase in monitoring. Yet the cumulative effect of these bargains, each seemingly attractive on its own, will be the relentless destruction of privacy.

A second difficulty is that privacy is such a subjective concept. Some people will love being able to keep track of their partner every moment of the day or night, others will loathe the idea. Some people will resist being observed by video cameras at work, at play and everywhere in-between, others will find it comforting. Individuals are likely to find it hard or impossible to opt out of these new systems. Decisions on where to draw the line on privacy must, for the most part, be collective ones, and stopping the introduction of new privacy-destroying technology will call for a degree of consensus that will be hard to achieve.

The debate is being complicated by the distinction between the collection of information by governments and by the private sector. For understandable reasons, governments remain the larger worry for most people. In the 20th century it was Big Brother governments, not marketing firms, that became nightmares. And yet in the networked society of the future it could well prove easier to tame an overly intrusive government than a private sector hungry for more and more information. An entrepreneurial private sector, driven by competition to seize on every new technological possibility, is likely to find ways round most obstacles placed in its way. And whatever information the private sector collects will be accessible to the government too, through subpoenas and search warrants. E-mails have already become a staple of court cases.

In the networked society of the future it could well prove easier to tame an overly intrusive government than a private sector hungry for more and more information

It does not help that the issue of privacy does not fit conveniently into existing political frameworks. Privacy defenders have come from across the political spectrum, as have its opponents, and the debate has already produced some strange political bedfellows. Social conservatives are usually suspicious of government meddling, but many, especially in America, think that personal privacy is being used as a cover for activities they disapprove of, such as abortion or homosexuality. Their opponents among radical feminists and left-wing advocates of political correctness have also sometimes argued against privacy rights, but for different reasons, dismissing them as a means of cloaking patriarchal oppression, racial abuse and a host of other evils. Both, in their way, have supported intrusions into private lives to achieve social-engineering goals.

Even some libertarians, for whom individual privacy should be a precious good, have argued against regulating the collection of data by companies as an infringement of corporate rights, both of free speech (in reporting transactions with their customers) and of the general right of human beings to learn about one another in an open society. At the other end of the political spectrum, Amitai Etzioni, America's leading communitarian, detects a “pro-privacy” bias in American life, though mainly because, unlike his libertarian opponents, he wants to let the government exploit the advantages of new technologies through a national ID card and greater access to private databases.

Nothing is perfect

If any degree of privacy is to be retained in the face of technological advances already on the horizon, an array of measures must be employed—though all have drawbacks:

• Legislation. The right to privacy is enshrined in most national constitutions as well as in international human-rights treaties, and protected by a host of laws, but legislation has proved a porous barrier to the rising tide of electronic monitoring. By its nature, the law tends to lag behind new technological developments, so it often regulates past rather than present or future threats to privacy. And in a globally wired world, nationally based privacy laws may no longer be effective. Moreover, legal remedies must be pursued by individual citizens, who may not have the time or the resources required.

America's consumer-credit laws, passed in the 1970s, give individuals the right to examine their credit records and to demand corrections. The EU Data Protection directive, which came into force in 1998, goes a lot further, aiming to give people control over their data and requiring “unambiguous” consent before a company or agency can process them. But so far it has had little effect. One giant loophole was left by the lack of agreement with the United States, which refused to pass a similar law. To avoid a trade war over the issue, the EU had to offer a “safe harbour” from EU legal action for American firms that promised to abide by a set of rules guaranteeing the rights of EU consumers. In fact, few individuals have been determined enough to pursue their rights either under the EU law or through the EU-American “safe harbour” agreement. And yet in a recent survey of 10,000 people by the European Commission, most said they felt their personal information was insufficiently protected.

• Market solutions. Self-regulation, the approach favoured by the United States, seems to have left consumers even less reassured. Last August, Microsoft agreed that the Federal Trade Commission, which had accused the company of breaching its privacy promises to consumers, should monitor Microsoft's Passport identification system for the next 20 years. The company is a key member of “Truste”, one of the computer and telecommunications industries' leading self-regulatory groups, but Truste clearly failed to notice the breach.

A popular idea in the 1990s was that firms called “infomediaries” would emerge as brokers of information between consumers and other companies. They would release only such data as individuals were happy to reveal, and protect the rest. So far, however, the only real infomediaries have been firms such as Microsoft and AOL, which have the most to gain by commercially exploiting their huge databases on users. Many companies already promise that they will not sell information they collect about their customers, but such pledges are not always kept. In a world where most transactions in life are conducted electronically, consumers who want privacy would have to be ever vigilant, constantly making decisions about how much information they were willing to give away in exchange for other benefits. As is already clear, this is more than most can manage. Besides, market solutions are unlikely to be able to deal with growing government databases or increased surveillance in public places.

• Technology. In the 1990s a fierce war was waged between encryption fans on the internet on the one hand and governments, especially America's, on the other. The governments argued that they needed access to encryption keys to be able to enforce the law. They largely lost, mainly because they could find no guaranteed way to crack sophisticated new codes, though most governments retain the legal right to demand keys from suspects in criminal cases. In fact, few people, even terrorists, use encryption regularly. Fewer still use specialised internet portals that guarantee anonymous browsing. This could change if concern about web privacy grows. But technology can only ever be a partial answer. Privacy will be threatened not only by government or private snooping, but by the constant recording of all sorts of information that individuals must provide to receive products or benefits—which is as true off as on the internet.

Ironically, the most effective solution to the privacy problem may be something that most privacy defenders fiercely resist: a highly secure identification system, perhaps linked to two or three different biometric measures. True, this would give a great boost to ubiquitous monitoring, but it would also make it possible to track precisely who taps into databases. This seems essential if access to databases is ever going to be properly controlled.

Try transparency

Given the sheer difficulty of protecting privacy in the face of ever more sophisticated technology, is it worth even trying? David Brin, a physicist and science-fiction writer, has attracted a lot of attention with his 1998 book “The Transparent Society”, in which he argues for much less, not more, privacy protection. Attempts to protect privacy usually benefit only the rich and powerful, or else the government, he says. Transparency is almost always a better option. Let everyone have access to databases, peer through CCTV cameras and listen in on conversations, Mr Brin says. “Mutually assured surveillance” would see to it that most people did not abuse their access to information.

The trouble is that, on current evidence, most people would be unwilling to live with such an arrangement. In “The Truman Show”, a recent Hollywood film, the hero abandons the only life he knows to evade the pitiless gaze of the cameras, having discovered that he has been the subject of a reality-TV show since birth. His bid for freedom is a desperate attempt to retrieve his humanity, something that most people would sympathise with. Every society, however primitive or poor, has had some concept of privacy, and has employed mechanisms to protect it. Despite the relentless advance of monitoring, the odds are that, in some form difficult to specify as yet, privacy will survive.